{"record":{"id":"67b1955855381b38","repo":"micro/go-micro","slug":"no-secret-key-is-defined","errorCode":null,"errorMessage":"no secret key is defined","messagePattern":"no secret key is defined","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/secrets/secretbox/secretbox.go","lineNumber":35,"sourceCode":"\n\tsecretKey [keyLength]byte\n}\n\n// NewSecrets returns a secretbox codec.\nfunc NewSecrets(opts ...secrets.Option) secrets.Secrets {\n\tsb := &secretBox{}\n\tfor _, o := range opts {\n\t\to(&sb.options)\n\t}\n\treturn sb\n}\n\nfunc (s *secretBox) Init(opts ...secrets.Option) error {\n\tfor _, o := range opts {\n\t\to(&s.options)\n\t}\n\tif len(s.options.Key) == 0 {\n\t\treturn errors.New(\"no secret key is defined\")\n\t}\n\tif len(s.options.Key) != keyLength {\n\t\treturn errors.Errorf(\"secret key must be %d bytes long\", keyLength)\n\t}\n\tcopy(s.secretKey[:], s.options.Key)\n\treturn nil\n}\n\nfunc (s *secretBox) Options() secrets.Options {\n\treturn s.options\n}\n\nfunc (s *secretBox) String() string {\n\treturn \"nacl-secretbox\"\n}\n\nfunc (s *secretBox) Encrypt(in []byte, opts ...secrets.EncryptOption) ([]byte, error) {\n\t// no opts are expected, so they are ignored","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/config/secrets/secretbox/secretbox.go#L17-L53","documentation":"The secretbox (NaCl secretbox, symmetric) backend's Init requires a shared secret key. This error is thrown when Init is called (or no options provide a key), leaving options.Key empty. Without a key the backend cannot encrypt or decrypt.","triggerScenarios":"Calling Init() with no options; passing options that configure other fields but not Key; constructing the secretBox backend without wiring the key from config or environment.","commonSituations":"Environment variable for the secret not set in the deployment; config file missing the key field; a refactor renamed the option so the old one is silently ignored.","solutions":["Pass the key to Init, e.g. sb.Init(secrets.WithKey(key)) with a 32-byte key.","Load the key from your environment/config and check it is non-empty and exactly 32 bytes before Init.","Fail fast at startup: if the key is missing, abort boot with a clear operator-facing message."],"exampleFix":"// before\nsb.Init()\n// after\nkey := os.Getenv(\"SECRETBOX_KEY\")\nif len(key) != 32 {\n    log.Fatal(\"SECRETBOX_KEY must be exactly 32 bytes\")\n}\nsb.Init(secrets.WithKey([]byte(key)))","handlingStrategy":"validation","validationCode":"key := []byte(os.Getenv(\"SECRETBOX_KEY\"))\nif len(key) == 0 {\n    return errors.New(\"SECRETBOX_KEY is required\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Load and validate the key at process start, fail fast","Centralize key loading in one helper used by both encrypt and decrypt paths","Document the exact 32-byte requirement for operators"],"tags":["crypto","secretbox","configuration","missing-key"],"backgroundTag":"missing-secret-key","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}